CVE-2012-4681 Oracle JDK
| Affected software | Oracle JDK |
|---|---|
| Severity | 9.8 Critical CVSS 3.1 3 scores |
| Weakness | Improper access control (CWE-284) |
| Published | 28 Aug 2012 |
| Updated | 29 Sep 2026 |
Description
Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using "reflection with a trusted immediate caller" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.
Exploitation status
Exploited
Confirmed real-world exploitation.
Exploitation status
- CISA KEV listed Confirmed exploitation in the wild. Added 2022-03-03 · remediation due 2022-03-24 · ransomware use: known
- VulnCheck KEV listed Exploitation reported in the wild. 12 citations · 2 exploits · earliest 2012-08-28.
- CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
- Indexed PoC 4 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Metasploit; first seen 2012-08-27.
- EPSS 99% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2012-4681 in VulnCheck (free account), which lists 7 more citations not shown here.
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Reported exploitation | cve.org | /CVERecord?id=CVE-2012-4681 | 2012-08-28 |
| Reported exploitation | cisa.gov | /news-events/alerts/2012/08/27/oracle-java-7-security-manager-bypass-vulnerability | 2013-01-23 |
| Reported exploitation | fireeye.com | /content/dam/fireeye-www/global/en/current-threats/pdfs/wp-operation-ke3chang.pdf | 2014-02-01 |
| Reported exploitation | securelist.com | /the-epic-turla-operation/65545 | 2014-08-07 |
| Reported exploitation | media.kasperskycontenthub.com | /wp-content/uploads/sites/43/2018/03/08064459/Equation_group_questions_and_answers.pdf | 2015-02-01 |
| Exploit reference | VulnCheck XDB 488e09b7437c | Exploit type: local | 2014-09-26 |
| Exploit reference | VulnCheck XDB b7ad75c598ae | Exploit type: local | 2023-12-21 |
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | An A/V evasion armoring experiment for CVE-2012-4681 | 1 | 2014-09-26 |
| GitHub PoC | A Simple PoC for CVE-2012-4681 | 2018-01-05 | |
| Exploit-DB | Java 7 Applet - Remote Code Execution (Metasploit) | 2012-08-27 | |
| Metasploit | Java 7 Applet Remote Code Execution (excellent rank) |
Waratek protection
A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.
- Protection none
- Action not pursued none
- Review human Researcher
- Record active
| Decided by | A researcher's recorded decision for this specific CVE |
|---|---|
| Finding | A researcher set this CVE's status to Outside Waratek scope. |
Waratek research note
written 2026-11-13Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.
Java applet / Web Start sandbox escape: needs untrusted code running under the Java sandbox, which a server running trusted code never does.
CVSS
9.8 CRITICAL
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3 metrics
CVSS
9.8 CRITICAL v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
NVD | Primary | published |
| CVSS 3.1 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CISA-ADP | Secondary | |
| CVSS 2.0 | 10.0 | none | AV:N/AC:L/Au:N/C:C/I:C/A:C |
NVD | Primary |
Affected software and releases
Products and versions
6 products, 85 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | oracle | jdk | javase | 1.6.0 · 1.6.0:update1 · 1.6.0:update2 · 1.6.0:update3 · 1.6.0:update4 · 1.6.0:update5 · 1.6.0:update6 · 1.6.0:update7 · 1.6.0:update8 · 1.6.0:update9 · 1.6.0:update10 · 1.6.0:update11 · 1.6.0:update12 · 1.6.0:update13 · 1.6.0:update14 · 1.6.0:update15 · 1.6.0:update16 · 1.6.0:update17 · 1.6.0:update18 · 1.6.0:update19 · 1.6.0:update20 · 1.6.0:update21 · 1.6.0:update22 · 1.6.0:update23 · 1.6.0:update24 · 1.6.0:update25 · 1.6.0:update26 · 1.6.0:update27 · 1.6.0:update29 · 1.6.0:update30 · 1.6.0:update31 · 1.6.0:update32 · 1.6.0:update33 · 1.6.0:update34 · 1.7.0 · 1.7.0:update1 · 1.7.0:update2 · 1.7.0:update3 · 1.7.0:update4 · 1.7.0:update5 · 1.7.0:update6 |
| nvd | oracle | jre | javase | 1.6.0 · 1.6.0:update1 · 1.6.0:update2 · 1.6.0:update3 · 1.6.0:update4 · 1.6.0:update5 · 1.6.0:update6 · 1.6.0:update7 · 1.6.0:update9 · 1.6.0:update10 · 1.6.0:update11 · 1.6.0:update12 · 1.6.0:update13 · 1.6.0:update14 · 1.6.0:update15 · 1.6.0:update16 · 1.6.0:update17 · 1.6.0:update18 · 1.6.0:update19 · 1.6.0:update20 · 1.6.0:update21 · 1.6.0:update22 · 1.6.0:update23 · 1.6.0:update24 · 1.6.0:update25 · 1.6.0:update26 · 1.6.0:update27 · 1.6.0:update29 · 1.6.0:update30 · 1.6.0:update31 · 1.6.0:update32 · 1.6.0:update33 · 1.6.0:update34 · 1.7.0 · 1.7.0:update1 · 1.7.0:update2 · 1.7.0:update3 · 1.7.0:update4 · 1.7.0:update5 · 1.7.0:update6 |
| nvd | redhat | enterprise linux desktop | generic | 6.0 |
| nvd | redhat | enterprise linux eus | generic | 6.3 |
| nvd | redhat | enterprise linux server | generic | 6.0 |
| nvd | redhat | enterprise linux workstation | generic | 6.0 |
References
| URL | Tags |
|---|---|
| https://access.redhat.com/errata/RHSA-2012:1223 | ADVISORY, RHSA-2012:1223 |
| https://access.redhat.com/security/cve/CVE-2012-4681 | REPORT, RHSA-2012:1223 |
| http://blog.fireeye.com/research/2012/08/zero-day-season-is-not-over-yet.html | Third Party Advisory |
| http://immunityproducts.blogspot.com/2012/08/java-0day-analysis-cve-2012-4681.html | Exploit, Third Party Advisory |
| http://labs.alienvault.com/labs/index.php/2012/new-java-0day-exploited-in-the-wild/ | Broken Link, Exploit |
| http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00032.html | Mailing List |
| http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00016.html | Mailing List |
| http://marc.info/?l=bugtraq&m=135109152819176&w=2 | Issue Tracking, Mailing List, Third Party Advisory |
| http://rhn.redhat.com/errata/RHSA-2012-1225.html | Third Party Advisory |
| http://secunia.com/advisories/51044 | Not Applicable |
Timeline
Timeline
| Published | 2012-08-28 | By the CVE Program. |
|---|---|---|
| VulnCheck KEV: earliest evidence | 2012-08-28 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| Added to CISA KEV | 2022-03-03 | Listed in CISA's Known Exploited Vulnerabilities catalog. |
| VulnCheck KEV: latest evidence | 2023-12-21 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |
| NVD record modified | 2026-08-06 | NVD's own last-modified date for this record. |
| Last VRT activity | 2026-09-29 | Most recent commit touching this CVE's classification, patch or rule file. |
| Classification created | 2026-11-13 | First commit adding this CVE's research note. |